#ParsedReport
21-07-2022
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-gootloader-and-icedid
Actors/Campaigns:
Xinglocker
Threats:
Gootloader
Icedid
Cobalt_strike
Process_hollowing_technique
Pingpull
Antidebugging_technique
Sandbox_evasion_technique
Conti
Quantum_locker
Quantum_tool
Industry:
Financial
Geo:
Apac, America, Africa, Emea
IOCs:
Registry: 6
Domain: 1
File: 2
Hash: 4
Softs:
active directory
Algorithms:
exhibit
Functions:
Foad, WriteProcessMemory, GetTickCount, GetComputerNameExW, GetUserNameW, Test, GetAdaptersInfo
Languages:
java, php
YARA: Found
21-07-2022
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-gootloader-and-icedid
Actors/Campaigns:
Xinglocker
Threats:
Gootloader
Icedid
Cobalt_strike
Process_hollowing_technique
Pingpull
Antidebugging_technique
Sandbox_evasion_technique
Conti
Quantum_locker
Quantum_tool
Industry:
Financial
Geo:
Apac, America, Africa, Emea
IOCs:
Registry: 6
Domain: 1
File: 2
Hash: 4
Softs:
active directory
Algorithms:
exhibit
Functions:
Foad, WriteProcessMemory, GetTickCount, GetComputerNameExW, GetUserNameW, Test, GetAdaptersInfo
Languages:
java, php
YARA: Found
eSentire
eSentire Threat Intelligence Malware Analysis: Gootloader and IcedID
Dive deeper into the technical details gathered during eSentire’s Threat Response Unit (TRU) team’s research and threat analysis of the Gootloader malware and IcedID payload.
#ParsedReport
21-07-2022
LockBit 3.0 Update \| Unpicking the Ransomwares Latest Anti-Analysis and Evasion Techniques
https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques
Actors/Campaigns:
Blackmatter
Threats:
Lockbit
Cobalt_strike
Socgholish_loader
Uac_bypass_technique
Blackcat
Egregor
Antidebugging_technique
Conti
Process_injection_technique
Industry:
Financial
Geo:
Russian, Ukraine
TTPs:
IOCs:
Hash: 6
Domain: 19
Softs:
thebat, powerpnt, steam, encsvc, dbsnmp, windows service, onenote, msexchange, zcash, wordpad
Algorithms:
xor, exhibit
Functions:
NtSetInformationThread
21-07-2022
LockBit 3.0 Update \| Unpicking the Ransomwares Latest Anti-Analysis and Evasion Techniques
https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques
Actors/Campaigns:
Blackmatter
Threats:
Lockbit
Cobalt_strike
Socgholish_loader
Uac_bypass_technique
Blackcat
Egregor
Antidebugging_technique
Conti
Process_injection_technique
Industry:
Financial
Geo:
Russian, Ukraine
TTPs:
IOCs:
Hash: 6
Domain: 19
Softs:
thebat, powerpnt, steam, encsvc, dbsnmp, windows service, onenote, msexchange, zcash, wordpad
Algorithms:
xor, exhibit
Functions:
NtSetInformationThread
SentinelOne
LockBit 3.0 Update | Unpicking the Ransomware's Latest Anti-Analysis and Evasion Techniques
The self-proclaimed 'oldest ransomware affiliate on the planet' has new tricks and new features and continues to beat enterprise defenses.
#ParsedReport
21-07-2022
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Actors/Campaigns:
Evilnum (motivation: information_theft)
Venom_spider
Industry:
Financial
IOCs:
Domain: 8
File: 7
Url: 11
Path: 1
Hash: 5
Email: 5
Softs:
windows defender, microsoft word
Languages:
java
21-07-2022
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Actors/Campaigns:
Evilnum (motivation: information_theft)
Venom_spider
Industry:
Financial
IOCs:
Domain: 8
File: 7
Url: 11
Path: 1
Hash: 5
Email: 5
Softs:
windows defender, microsoft word
Languages:
java
Proofpoint
Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities | Proofpoint US
Key Findings TA4563 is a threat actor leveraging EvilNum malware to target European financial and investment entities, especially those with operations supporting foreign exchanges,
#ParsedReport
21-07-2022
Attackers target Ukraine using GoMet backdoor
http://blog.talosintelligence.com/2022/07/attackers-target-ukraine-using-gomet.html
Threats:
Gomet_dropper
Industry:
Government
Geo:
Ukrainian, Ukraine, Russian, Ukrainians
CVEs:
CVE-2020-5902 [Vulners]
Vulners: Score: 10.0, CVSS: 4.6,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, le15.0.1.4, <15.1.0.4)
- f5 big-ip advanced firewall manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip advanced web application firewall (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip analytics (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip application acceleration manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
have more...
CVE-2022-1040 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- sophos sfos (le18.5.3)
IOCs:
File: 6
Hash: 3
Path: 1
IP: 1
Softs:
task scheduler
Links:
21-07-2022
Attackers target Ukraine using GoMet backdoor
http://blog.talosintelligence.com/2022/07/attackers-target-ukraine-using-gomet.html
Threats:
Gomet_dropper
Industry:
Government
Geo:
Ukrainian, Ukraine, Russian, Ukrainians
CVEs:
CVE-2020-5902 [Vulners]
Vulners: Score: 10.0, CVSS: 4.6,
Vulners: Exploitation: True
X-Force: Risk: 10
X-Force: Patch: Official fix
Soft:
- f5 big-ip access policy manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, le15.0.1.4, <15.1.0.4)
- f5 big-ip advanced firewall manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip advanced web application firewall (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip analytics (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
- f5 big-ip application acceleration manager (<11.6.5.2, <12.1.5.2, <13.1.3.4, <14.1.2.6, <15.0.1.4, <15.1.0.4)
have more...
CVE-2022-1040 [Vulners]
Vulners: Score: 7.5, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- sophos sfos (le18.5.3)
IOCs:
File: 6
Hash: 3
Path: 1
IP: 1
Softs:
task scheduler
Links:
https://github.com/Laeeth/GoMetCisco Talos Blog
Attackers target Ukraine using GoMet backdoor
Executive summary
Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks. Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine…
Since the Russian invasion of Ukraine began, Ukrainians have been under a nearly constant barrage of cyber attacks. Working jointly with Ukrainian organizations, Cisco Talos has discovered a fairly uncommon piece of malware targeting Ukraine…
#ParsedReport
21-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/?utm_source=rss&utm_medium=rss&utm_campaign=the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Palestine, Yemen, Lebanon, Turkey
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
google chrome, chrome, chromium
Algorithms:
rsa-2048, aes-256-cbc
Languages:
java, Javascript
Links:
21-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/?utm_source=rss&utm_medium=rss&utm_campaign=the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Palestine, Yemen, Lebanon, Turkey
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
google chrome, chrome, chromium
Algorithms:
rsa-2048, aes-256-cbc
Languages:
java, Javascript
Links:
https://github.com/avast/ioc/tree/master/CandiruGendigital
The Return of Candiru: Zero-days in the Middle East
Zero-day vulnerability in Google Chrome discovery
#ParsedReport
21-07-2022
Profiling YDIO, the Blackhat Group Behind #OpBRICS. Appendix
https://cloudsek.com/threatintelligence/profiling-ydio-the-blackhat-group-behind-opbrics/?utm_source=rss&utm_medium=rss&utm_campaign=profiling-ydio-the-blackhat-group-behind-opbrics
Actors/Campaigns:
Ydio
Industry:
Government, Healthcare, Telco
Geo:
Russian, Africa, Russia, Chinese, Brazil, China, Belarus, India
TTPs:
Tactics: 1
Technics: 0
Softs:
telegram
21-07-2022
Profiling YDIO, the Blackhat Group Behind #OpBRICS. Appendix
https://cloudsek.com/threatintelligence/profiling-ydio-the-blackhat-group-behind-opbrics/?utm_source=rss&utm_medium=rss&utm_campaign=profiling-ydio-the-blackhat-group-behind-opbrics
Actors/Campaigns:
Ydio
Industry:
Government, Healthcare, Telco
Geo:
Russian, Africa, Russia, Chinese, Brazil, China, Belarus, India
TTPs:
Tactics: 1
Technics: 0
Softs:
telegram
Cloudsek
Profiling YDIO, the Blackhat Group Behind #OpBRICS | Threat Intelligence | CloudSEK
XVigil discovered a new operation named #OpBRICS launched by the threat actor group Your Data is Ours (YDIO) against the following five major emerging economies:
#ParsedReport
21-07-2022
AppleSeed. AppleSed is distributed to certain military maintenance companies
https://asec.ahnlab.com/ko/36918
Actors/Campaigns:
Kimsuky
Threats:
Appleseed
IOCs:
File: 4
Path: 1
Hash: 2
Url: 2
21-07-2022
AppleSeed. AppleSed is distributed to certain military maintenance companies
https://asec.ahnlab.com/ko/36918
Actors/Campaigns:
Kimsuky
Threats:
Appleseed
IOCs:
File: 4
Path: 1
Hash: 2
Url: 2
ASEC BLOG
특정 군부대 유지보수 업체 대상으로 AppleSeed 유포 - ASEC BLOG
ASEC 분석팀은 최근 특정 군부대 유지보수 업체 대상으로 AppleSeed 악성코드를 유포하는 정황을 포착하였다. AppleSeed 악성코드는 Kimsuky 조직에서 주로 사용되는 백도어성 악성코드로 최근 여러 대상을 타깃으로 활발히 유포하고 있다. 이번에는 특정 군부대의 이름이 담긴 아래와 같은 파일명으로 악성코드 유포가 이루어졌다. 20220713_****부대_설치 예상 일정V004_***시스 수정_6.xls 최초 엑셀 문서 형태(XLS)로 유포가…
#ParsedReport
21-07-2022
Analysis of a trojanized jQuery script: GootLoader unleashed
https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed
Threats:
Gootloader
Cobalt_strike
Kronos
Revil
Icedid
Gootkit
Cyberchef_tool
Beacon
Geo:
Germany
IOCs:
File: 1
Domain: 3
Url: 1
Hash: 11
Registry: 1
Functions:
CreateObject
Languages:
java, python
21-07-2022
Analysis of a trojanized jQuery script: GootLoader unleashed
https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed
Threats:
Gootloader
Cobalt_strike
Kronos
Revil
Icedid
Gootkit
Cyberchef_tool
Beacon
Geo:
Germany
IOCs:
File: 1
Domain: 3
Url: 1
Hash: 11
Registry: 1
Functions:
CreateObject
Languages:
java, python
NVISO Labs
Analysis of a trojanized jQuery script: GootLoader unleashed
Update 24/10/202: We have noticed 2 changes since we published this report 3 months ago. The code has been adapted to use registry key “HKEY_CURRENT_USER\SOFTWARE\Microsoft\Personalization” instead…
#ParsedReport
21-07-2022
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-understanding-the-lapsus-extortion-group
Actors/Campaigns:
Lapsus (motivation: information_theft, script_kiddie, politically_motivated, cyber_criminal)
Karakurt (motivation: information_theft)
Ransomhouse
Threats:
Conti
Empire_loader
Godfather
Silence
Avoslocker
Lockbit
Industry:
Telco, Financial, Media, Healthcare, Government
Geo:
America, Brazil, Portugal
IOCs:
File: 2
Softs:
tiktok, confluence, telegram, active directory, microsoft sharepoint
21-07-2022
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-understanding-the-lapsus-extortion-group
Actors/Campaigns:
Lapsus (motivation: information_theft, script_kiddie, politically_motivated, cyber_criminal)
Karakurt (motivation: information_theft)
Ransomhouse
Threats:
Conti
Empire_loader
Godfather
Silence
Avoslocker
Lockbit
Industry:
Telco, Financial, Media, Healthcare, Government
Geo:
America, Brazil, Portugal
IOCs:
File: 2
Softs:
tiktok, confluence, telegram, active directory, microsoft sharepoint
Tenable®
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
Попробовал повысить качество вытаскивания функций WIN API из отчетов. Посмотрим что получится )))
#ParsedReport
22-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Lebanon, Yemen, Turkey, Palestine
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
chrome, chromium, google chrome
Algorithms:
aes-256-cbc, rsa-2048
Languages:
javascript
Platforms:
apple
Links:
22-07-2022
The Return of Candiru: Zero-days in the Middle East
https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east
Threats:
Watering_hole_technique
Devilstongue
Geo:
Lebanon, Yemen, Turkey, Palestine
CVEs:
CVE-2022-2294 [Vulners]
Vulners: Score: Unknown, CVSS: PENDING,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
IOCs:
Domain: 11
Path: 30
Registry: 4
Softs:
chrome, chromium, google chrome
Algorithms:
aes-256-cbc, rsa-2048
Languages:
javascript
Platforms:
apple
Links:
https://github.com/avast/ioc/tree/master/CandiruGendigital
The Return of Candiru: Zero-days in the Middle East
Zero-day vulnerability in Google Chrome discovery
#ParsedReport
22-07-2022
OperationShadowTiger
https://mp.weixin.qq.com/s/jX8D8d-4q46pKHS0AIVgjw
Actors/Campaigns:
Shadowtiger
Tiger_hibiscus
Threats:
Dll_hijacking_technique
Putty_tool
Uacme
Geo:
Korean, Korea, Asia, Asian, Polish
CVEs:
CVE-2018-6055 [Vulners]
Vulners: Score: 6.8, CVSS: 4.9,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<64.0.3282.119)
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 19
Url: 3
Email: 2
IP: 5
Hash: 16
Softs:
chrome
Languages:
php
22-07-2022
OperationShadowTiger
https://mp.weixin.qq.com/s/jX8D8d-4q46pKHS0AIVgjw
Actors/Campaigns:
Shadowtiger
Tiger_hibiscus
Threats:
Dll_hijacking_technique
Putty_tool
Uacme
Geo:
Korean, Korea, Asia, Asian, Polish
CVEs:
CVE-2018-6055 [Vulners]
Vulners: Score: 6.8, CVSS: 4.9,
Vulners: Exploitation: Unknown
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<64.0.3282.119)
TTPs:
Tactics: 2
Technics: 0
IOCs:
File: 19
Url: 3
Email: 2
IP: 5
Hash: 16
Softs:
chrome
Languages:
php
#ParsedReport
22-07-2022
Proxyware. Attackers who make money using ProxyWare
https://asec.ahnlab.com/ko/36762
Threats:
Dropper/win.proxyware.c5173477
Dropper/win.proxyware.c5173478
Dropper/win.proxyware.c5210584
IOCs:
File: 8
Path: 1
Hash: 7
Softs:
ms-sql
Algorithms:
base64
Functions:
startMainRoutine
Platforms:
x86
22-07-2022
Proxyware. Attackers who make money using ProxyWare
https://asec.ahnlab.com/ko/36762
Threats:
Dropper/win.proxyware.c5173477
Dropper/win.proxyware.c5173478
Dropper/win.proxyware.c5210584
IOCs:
File: 8
Path: 1
Hash: 7
Softs:
ms-sql
Algorithms:
base64
Functions:
startMainRoutine
Platforms:
x86
ASEC
Proxyware를 이용해 수익을 얻는 공격자들 - ASEC
Proxyware를 이용해 수익을 얻는 공격자들 ASEC
#ParsedReport
22-07-2022
RedLine Stealer. Confirm the campaign to infect Redline Stealer from the fake site
https://blog.lac.co.jp/2022/07/21/1430
Actors/Campaigns:
Fakeupdates
Threats:
Redline_stealer
Geo:
Japan, Japanese
IOCs:
File: 7
Hash: 1
Url: 1
IP: 1
Softs:
chrome, google chrome
Algorithms:
base64
Languages:
javascript
22-07-2022
RedLine Stealer. Confirm the campaign to infect Redline Stealer from the fake site
https://blog.lac.co.jp/2022/07/21/1430
Actors/Campaigns:
Fakeupdates
Threats:
Redline_stealer
Geo:
Japan, Japanese
IOCs:
File: 7
Hash: 1
Url: 1
IP: 1
Softs:
chrome, google chrome
Algorithms:
base64
Languages:
javascript
ラック脅威情報ブログ
偽サイトからRedLine Stealerに感染させるキャンペーンを確認 | ラック脅威情報ブログ
ブラウザのChromeを装った偽のアップデート要求画面から、情報窃取型マルウェアの一種であるRedLine Stealerに感染させようとする攻撃を日本国内で確認しています。偽のアップデートファイルをダウンロード・実行してしまった場合、マルウェアに感染する恐れがあります。概要2022年4月頃に、改ざんされたと思われるいくつかの日本のサイト(JPドメイン)から、RedLine Stealerを配布するサイトに誘導される事例を確認しました。Chromeを装った偽
#ParsedReport
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
https://github.com/xmrig/xmrigTrend Micro
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
#ParsedReport
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
ASEC BLOG
국내 포털 사이트 Daum으로 위장한 피싱 메일 - ASEC BLOG
ASEC 분석팀은 해당 블로그 작성 날짜 기준으로 전날인, 2022년 7월 21일에 국내 포털 사이트 중 하나인 Daum으로 위장한 피싱 메일이 유포되고 있는 정황을 포착하였다. 해당 피싱 메일은 제목에 RFQ를 포함하여 견적 요청서로 둔갑하였으며, 첨부 파일을 이용하여 피싱 페이지로 유도하도록 만들어졌다. 첨부 파일은 HTML 파일로 이루어져 있으며, 첨부 파일을 실행하면 자동으로 아래 주소로 리다이렉션된다. hxxps://euoi8708twufev…
#ParsedReport
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
Всем привет.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
winapi_funcs.yml
564 KB
Постепенно выхожу из стазиса.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Кстати ,вот регулярка, которая тоже помогает выявить название WIN API функции в тексте
(^| )((Alpc|Cc|Cm|Dbg|Dbgk|Em|Etw|Ex|FsRtl|Hv|Hvl|Io|Kd|Ke|Kse|Lsa|Mm|Nt|Ob|Pf|Po|PoFx|Pp|Ppm|Ps|Rtl|Se|SH|Sm|Tm|Ttm|Vf|Vsl|Wdi|Wfp|Whea|Wmi|Zw)([A-Z][a-z]+){3,}[A-Z]?)([., ]|$)#ParsedReport
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
ASEC BLOG
ASEC 주간 악성코드 통계 (20220718 ~ 20220724) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 7월 18일 월요일부터 7월 24일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 44.7%로 1위를 차지하였으며, 그 다음으로는 백도어 악성코드가 40.3%, 다운로더 14.5%, 랜섬웨어 0.6%로 집계되었다. Top 1 – Agent Tesla 인포스틸러 악성코드인…